Legal

Privacy Policy

Last updated: 1 July 2026  ·  Nordic Nutrition and Metabolic Center for Child Development

This Privacy Policy describes how Nordic Nutrition and Metabolic Center for Child Development ("NNMCCD", "we", "us") collects, uses, and protects personal data in accordance with the General Data Protection Regulation (GDPR) and Norwegian personal data legislation (personopplysningsloven).

1. Data controller

Nordic Nutrition and Metabolic Center for Child Development Organisation number: 937 889 151 Registered address: Evjeveien 29, 1338 Sandvika, Norway Contact: contact.nnmccd@gmail.com Website: nnmccd.org

2. What data we collect and why

We collect only the personal data necessary to operate our membership programme, communicate with supporters, and fulfil our obligations under Norwegian law.

Data Purpose Legal basis (GDPR)
Name, email address Administering your membership; sending member newsletters and updates about NNMCCD Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest
Phone number Vipps payment processing; contact for membership matters Art. 6(1)(b) — contract
Payment information Processing membership fees via Vipps Recurring; accounting records Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation
Membership type and start date Managing membership status and renewal; grant reporting (aggregated/anonymised) Art. 6(1)(b) — contract
Petition signature (name, support statement) Advocacy for leucovorin access; submission to relevant authorities Art. 6(1)(a) — consent
Website usage data (cookies, IP address) Website analytics; improving user experience Art. 6(1)(a) — consent

3. Payment processing (Vipps)

Membership fees are processed through Vipps AS, which acts as an independent data controller for payment processing. When you approve a Vipps payment or recurring agreement, your payment details are handled directly by Vipps. NNMCCD does not store your card or bank account details.

Vipps's own privacy policy is available at vipps.no/vilkar/personvern/.

4. Data sharing

We do not sell or rent your personal data. We share data only in the following cases:

Any third-party processors we use are bound by data processing agreements and may only process your data according to our instructions.

5. Data retention

Data type Retention period
Membership records (name, email, membership type) 5 years after membership ends (accounting obligations under Norwegian law)
Payment transaction records 5 years (Norwegian Bookkeeping Act — bokføringsloven)
Petition signatures Until the petition campaign concludes; deleted within 12 months of submission unless actively used in advocacy
Newsletter subscriber data Until you unsubscribe; promptly deleted upon request
Website analytics (cookies) As set by our analytics provider; typically 12–26 months

6. Cookies

Our website uses cookies — small text files stored in your browser. We use:

You can manage or withdraw cookie consent at any time through your browser settings, or by clicking "Cookie settings" in the footer of this website. Withdrawing consent does not affect processing already carried out.

7. Your rights

Under the GDPR, you have the following rights in relation to your personal data:

Right of access Request a copy of the personal data we hold about you.
Right to rectification Ask us to correct inaccurate or incomplete data.
Right to erasure Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
Right to restrict processing Ask us to limit how we use your data in certain circumstances.
Right to data portability Receive your data in a structured, machine-readable format.
Right to object Object to processing based on legitimate interest or for direct marketing.
Right to withdraw consent Withdraw consent at any time where processing is based on consent (petition, newsletters, analytics cookies).
Right to complain Lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority).

To exercise any of these rights, contact us at contact.nnmccd@gmail.com. We will respond within 30 days.

8. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Payment data is handled exclusively by Vipps AS using their secure payment infrastructure.

9. Children's data

NNMCCD works with and for children with neuroatypical conditions. Where we process data relating to children, we do so on the basis of consent from a parent or legal guardian. Health-related data concerning children is treated as sensitive personal data under Art. 9 GDPR and is processed only with explicit consent and appropriate safeguards.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to members at least 30 days before they take effect. The current version is always available on this page. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Contact

For any questions about this policy or how we handle your personal data, contact us at:

Nordic Nutrition and Metabolic Center for Child Development Evjeveien 29, 1338 Sandvika, Norway Org.nr: 937 889 151 Email: contact.nnmccd@gmail.com

If you are not satisfied with our response, you may contact Datatilsynet (Norwegian Data Protection Authority) at datatilsynet.no or by phone: +47 74 07 70 00.